SharePoint must reject or delay, as defined by the organization, network traffic generated above configurable traffic volume thresholds.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-59955	SP13-00-000060	SV-74385r1_rule		Medium

Description
It is critical when a system is at risk of failing to process audit logs as required; actions are automatically taken to mitigate the failure or risk of failure. One method used to thwart the auditing system is for an attacker to attempt to overwhelm the auditing system with large amounts of irrelevant data. The end result is audit logs that are either overwritten and activity thereby erased or disk space that is exhausted and any future activity is no longer logged. In many system configurations, the disk space allocated to the auditing system is separate from the disks allocated for the operating system; therefore, this may not result in a system outage.

Description

It is critical when a system is at risk of failing to process audit logs as required; actions are automatically taken to mitigate the failure or risk of failure. One method used to thwart the auditing system is for an attacker to attempt to overwhelm the auditing system with large amounts of irrelevant data. The end result is audit logs that are either overwritten and activity thereby erased or disk space that is exhausted and any future activity is no longer logged. In many system configurations, the disk space allocated to the auditing system is separate from the disks allocated for the operating system; therefore, this may not result in a system outage.

STIG	Date
MS SharePoint 2013 Security Technical Implementation Guide	2018-06-27

Details

Check Text ( C-60645r2_chk )
Review the SharePoint server configuration to ensure network traffic generated above configurable traffic volume thresholds, as defined by the organization or site SSP, is rejected or delayed. Log on to the server. Click Start. Type Internet Information Services Manager in the Search Bar, click Enter. Determine which IIS Sites are subject to user traffic. This is generally the IIS site hosting the Content Web Application. For each site IIS site subject to user traffic, select the site. Click Advanced Settings. Expand Connection Limits. Ensure the following settings possess a value: -Connection Time-Out -Maximum Bandwidth -Maximum Concurrent Connections Repeat steps for each site subject to user traffic. Otherwise, this is a finding.

Check Text ( C-60645r2_chk )

Review the SharePoint server configuration to ensure network traffic generated above configurable traffic volume thresholds, as defined by the organization or site SSP, is rejected or delayed.

Log on to the server.

Click Start.

Type Internet Information Services Manager in the Search Bar, click Enter.

Determine which IIS Sites are subject to user traffic. This is generally the IIS site hosting the Content Web Application.

For each site IIS site subject to user traffic, select the site.

Click Advanced Settings.

Expand Connection Limits.

Ensure the following settings possess a value:
-Connection Time-Out
-Maximum Bandwidth
-Maximum Concurrent Connections

Repeat steps for each site subject to user traffic.

Otherwise, this is a finding.

Fix Text (F-65365r2_fix)
Configure SharePoint to reject or delay, as defined by the organization or site SSP, network traffic generated above configurable traffic volume thresholds. Log on to the server. Click Start. Type Internet Information Services Manager in the Search Bar, click Enter. Determine which IIS Sites are subject to user traffic. This is generally the IIS site hosting the Content Web Application. For each site IIS site subject to user traffic, select the site. Click Advanced Settings. Expand Connection Limits. Ensure the following settings possess a value: -Connection Time-Out -Maximum Bandwidth -Maximum Concurrent Connections Repeat steps for each site subject to user traffic.

Fix Text (F-65365r2_fix)

Configure SharePoint to reject or delay, as defined by the organization or site SSP, network traffic generated above configurable traffic volume thresholds.

Log on to the server.

Click Start.

Type Internet Information Services Manager in the Search Bar, click Enter.

Determine which IIS Sites are subject to user traffic. This is generally the IIS site hosting the Content Web Application.

For each site IIS site subject to user traffic, select the site.

Click Advanced Settings.

Expand Connection Limits.

Ensure the following settings possess a value:
-Connection Time-Out
-Maximum Bandwidth
-Maximum Concurrent Connections

Repeat steps for each site subject to user traffic.